Documentation

1. Introduction

RescueKit helps you recover trapped funds from hacked or compromised EVM wallets. By using EIP-7702, a separate clean wallet pays the gas fees so automated sweeper bots never get a chance to steal your gas. You can rescue tokens, NFTs, and unclaimed airdrops directly into a safe wallet in a single transaction.

1.1 How Sweeper Bots Work

When an account's private key or seed phrase leaks, automated MEV sweeper bots monitor the address across public transaction mempools and block builders. Sweeper bots maintain persistent RPC subscriptions listening for inbound transfers.

1. User sends gas to the compromised wallet.
2. Sweeper bot detects the incoming transfer.
3. Bot drains the gas to the attacker wallet within milliseconds.
4. The user never gets a chance to broadcast a transaction to move their funds.
5. Trapped assets remain stuck.

Under this hostile condition, traditional transactions (eth_sendRawTransaction) fail because the account owner cannot fund the account with the native gas required to broadcast any transaction. Any gas sent to the address is stolen within milliseconds by the bot.

1.2 How EIP-7702 Solves This

EIP-7702 allows an ordinary wallet (EOA) to temporarily delegate its execution to a smart contract without changing account ownership. By signing an authorization designating the RescueKit contract (0x0000000008732229ED6Dca402A3C9EbbF31068E7), the wallet gains the ability to execute batch rescue operations.

Crucially, EIP-7702 transactions can be sponsored by a separate, clean account (the "Sponsor Wallet"). The sponsor wallet pays 100% of the gas needed to broadcast and execute the rescue. Because the compromised account never receives or holds native gas, sweeper bots never get a chance to trigger.

2. Quick Start

2.1 What You Need

• Compromised wallet address and its private key.
• A clean, uncompromised safe destination address.
• A sponsor wallet created on RescueKit, funded with enough gas for the network fee.

2.2 How to Rescue

1. Create a sponsor wallet in the app and deposit gas into it.
2. Enter your compromised wallet address and select your network.
3. Select or enter the details to rescue.
4. Enter your clean safe destination address.
5. Click Review and enter your compromised private key.
6. Click Rescue to execute the rescue transaction.

3. Sponsor Wallet

The sponsor wallet is a clean burner wallet generated directly in your browser. It pays the gas fees for all your rescue transactions so your compromised wallet never needs to hold native gas.

3.1 How It Works

1. Click Generate Sponsor Wallet at the top of any rescue page to create your sponsor wallet in one click.
2. The wallet and its private key are generated client-side in your browser and encrypted locally using 256-bit AES-GCM.
3. Deposit a small amount of native gas (like ETH, POL, or BNB) into your sponsor wallet on the chain you want to rescue.
4. When you execute a rescue, the sponsor wallet broadcasts the transaction and pays the gas fees on behalf of your compromised wallet.

3.2 Managing Keys & Funds

• Click the three dots on the sponsor card and select Export Phrase / Key to view and copy your private key or 12-word seed phrase. You can also import this key into any external wallet app.
• You can withdraw any unused gas balance from your sponsor wallet back to any safe address directly from the app at any time.
• Click the three dots on the sponsor card and select Reset Wallet to clear and generate a fresh sponsor wallet whenever you want.

3.3 Tips & Safety

• Only deposit the gas needed to cover your planned rescues.
• Do not use the sponsor wallet as a primary wallet or to store personal savings. It is designed solely to pay gas fees for your rescues.

4. Token & NFT Rescue (/transfer)

The Transfer page recovers ERC-20 tokens, native coins, and NFTs already sitting in your compromised wallet.

4.1 How It Works

1. Enter your compromised address and select your networks. The scanner checks for tokens, native coins, and NFTs across all selected chains at the same time.
2. You can rescue multiple tokens, multiple NFTs, or both combined at once. If you selected multiple networks, you can rescue across all of them at the same time with one click.
3. If a token or NFT does not appear automatically, you can manually enter the contract address (and token ID for NFTs) to include it.
4. Once confirmed via Review and Rescue, the assets are swept directly into your safe destination wallet.
5. If an individual token or NFT transfer fails (for example, non-transferrable token or nft), it simply skips that token and continues rescuing the rest of your assets without canceling the entire transaction.

4.2 Fees

• For tokens and native currency, a 15% recovery fee is deducted on-chain directly from the recovered amount during the transfer.
• NFTs (ERC-721 and ERC-1155) are rescued with a 0% protocol fee. 100% of your NFTs go directly to your safe wallet.

5. NFT Mint Rescue (/mint)

The Mint page lets you mint NFTs (ERC-721 or ERC-1155) from an eligible or allowlisted compromised wallet, either sweeping them straight to your safe wallet in the same transaction or executing the mint on its own.

5.1 How It Works

1. Enter your compromised wallet address, safe destination address, and select the network where the mint takes place.
2. Select your Mint Mode from the dropdown.
   • Mint only: executes the mint function on the contract without sweeping the new NFT out of your wallet.
   • Mint + Transfer: mints the NFT and immediately sweeps it directly to your safe wallet in the same transaction.
3. Enter the Mint Contract Address and paste the Mint Calldata (hex). The app automatically checks the network to verify that the contract exists. (If the minting website blocks interaction due to zero gas balance, use the companion extension to capture and pre-fill this automatically.)
4. If the mint has a mint fee in native currency, enter the amount (like 0.01 or hex 0x...) in the Mint Price field. Your sponsor wallet pays this fee for you. For free mints, leave this blank.
5. In Mint + Transfer mode, if the NFT collection is the same contract as the mint contract, leave the NFT Contract Address blank. If the collection is a separate contract from the minting contract, enter the NFT contract address.
6. Native tokens in your compromised wallet are swept automatically by default. In Mint + Transfer mode, you can also select existing NFTs in your wallet to sweep them in the same transaction alongside your mint.
7. Click Review to enter your compromised private key, then click Rescue to execute the mint and sweep the NFTs directly into your safe wallet.

5.2 Finding Token IDs

Because an NFT's token ID cannot be known before minting, our contract discovers it on-chain during execution using three methods.

• Receiver hooks intercept standard safe mint callbacks (onERC721Received and onERC1155Received) to capture and redirect the token ID as it is minted.
• Return data decodes the token ID directly from the mint function's return value.
• Supply queries check nextTokenId() or totalSupply() on the collection contract to determine the new token ID.

If an NFT contract does not support any of these methods, the minted token ID is read from the transaction receipt and an automatic follow-up rescue broadcasts immediately to recover it. However, because this requires a separate transaction, there is a brief on-chain window before it confirms where the NFT could be intercepted, even though the follow-up broadcasts immediately.

5.3 Fees

• NFTs (ERC-721 and ERC-1155) are rescued with a 0% protocol fee. 100% of your minted and rescued NFTs go directly to your safe wallet.
• The standard 15% recovery fee applies only if native currency is swept from the wallet.

6. Airdrop & Claims Rescue (/claim)

The Claims page recovers claimable tokens from contracts like airdrops, staking, vesting, and more.

6.1 How It Works

1. Enter your compromised address and select your network.
2. Enter the claim contract address. The app automatically checks the network to verify that the contract exists. If the contract supports common claim functions, it is detected automatically, or you can paste your claim calldata. (If the claim site blocks interaction due to zero gas balance, use the companion extension to capture and pre-fill this automatically.)
3. If the claim requires a native fee, enter the amount (like 0.01 or hex 0x...) in the Value field. Your sponsor wallet pays this fee for you. If no fee is required, leave it blank.
4. The payout token is usually detected and filled in automatically, but always verify that the address is correct (or enter it manually if not detected). Native tokens are swept automatically by default, and you can also sweep existing tokens already sitting in your wallet by adding their contract addresses.
5. If a claim rewards multiple tokens at once, you can add extra token addresses to sweep all reward tokens together in one transaction.
6. You can add multiple claim boxes to execute different claims together at the same time.
7. Click Review to enter your compromised private key, then click Rescue to sweep your tokens directly into your safe wallet.

6.2 Follow-Up Rescues

If an individual claim fails (for example, if it expired), it simply skips that claim and continues rescuing your other claims without canceling the entire transaction.

Always enter the correct payout tokens so everything sweeps in the first transaction. If a contract transfers extra or unexpected tokens that you did not enter, an automatic follow-up rescue broadcasts immediately to recover them. However, because this requires a separate transaction, there is a brief on-chain window where tokens could be intercepted. While the follow-up rescue is fast, there is no guarantee in that window, so always double-check your token addresses.

6.3 Fees

• A 15% recovery fee is deducted on-chain directly from the claimed tokens during the rescue transaction.

7. Companion Extension

The browser extension extracts transaction calldata from third-party dApps when your compromised wallet has zero gas.

7.1 The Problem It Solves

When a compromised wallet is drained by sweeper bots, its native balance is zero. Most dApps (such as airdrop portals and NFT mints) check your wallet balance before enabling interaction buttons. When they detect 0 native coin, they lock the “Claim” or “Mint” button with “Insufficient balance for gas”.

Because the button is disabled, you cannot initiate the interaction to generate the contract calldata required for recovery.

The extension solves this:

1. Simulates a local gas balance so the dApp enables the interaction button.
2. Intercepts the transaction payload locally in your browser before it reaches the mempool.
3. Captures the target contract address and hex calldata, then automatically redirects to the web app with the parameters pre-filled.

7.2 Setup

1. Install RescueKit Companion from the Chrome Web Store (pending review by Google — not live yet).
2. Open the popup from your browser toolbar.
3. Enter your compromised wallet address and click Save.
4. Select the target network.

7.3 Airdrops & Claims (/claim)

1. In the popup, set Mode to Claim.
2. Select your target card:
   • Overwrite Card: Updates an existing claim card in the app (use the – / + buttons to choose Card #1, #2, etc.).
   • Add New Card: Creates a new claim box (useful when batching claims across different dApps into one transaction).
3. Open the dApp and connect your wallet via the companion provider.
4. Click Claim on the dApp.
5. The extension intercepts the payload and automatically redirects to the /claim page with the contract address and calldata pre-filled.

7.4 NFT Mints (/mint)

1. In the popup, set Mode to Mint.
2. Open the minting portal and connect your wallet.
3. Click Mint on the dApp.
4. The extension intercepts the payload and automatically redirects to the /mint page with the contract address and calldata pre-filled.

7.5 Key Notes

• Never asks for, stores, or handles private keys or seed phrases. The extension only accepts 40-character hex public addresses (0x...), strictly rejecting 64-character private keys, seed phrases, or invalid input.
• Runs 100% locally in your browser. No data is transmitted to external servers.
• Does not execute rescues or make transactions. It only extracts calldata for you to execute in the web app.
• Because the extension is strictly keyless, it cannot sign off-chain login messages (such as personal_sign or SIWE on platforms using Privy).

8. Referral Program (/refer)

The Referral page lets you generate a personal referral link to earn on-chain commissions by helping others recover their funds from compromised wallets.

8.1 How It Works

1. Go to the Refer & Earn page (/refer).
2. Enter your payout address (any clean EVM wallet where you want to receive commissions).
3. Copy your unique referral link or save the QR code to share.
4. When someone opens your link, your payout address is remembered in their browser for their rescues.
5. When they complete a successful rescue, 6% of the recovered assets are sent directly to your payout address in the exact same transaction.

8.2 Commissions & Payouts

• The standard recovery fee on tokens and native assets is 15%. When a rescue happens through a referral link, 6% goes to the referrer and 9% goes to the protocol. The recovering user always receives their full 85% net assets whether they use a referral link or not.
• NFTs are rescued with 0% protocol fee, so no referral fee applies to NFT rescues.
• Payouts are instant and on-chain. There are no claim portals, points, or withdrawal delays, and commissions land in your wallet the moment the rescue transaction confirms.
• Commission applies to the referred wallet's first successful rescue on each supported network. For example, if a user rescues on Ethereum, you receive commission on Ethereum. If they also rescue on Monad, you receive commission on Monad. Any subsequent rescues by the same wallet on the same network do not pay a commission.
• Anti-self-referral checks prevent an account from earning commissions on its own rescues. The referrer address cannot be the compromised wallet, the sponsor wallet, or the safe destination address.
• If a referrer payout address is a smart contract that rejects the transfer, the commission routes to the protocol so the rescue transaction never fails. Always use a standard wallet address (EOA) so you never miss out on payouts.

9. Fees & How They Work

RescueKit collects fees on-chain during execution. Understanding how fees are charged and the order in which transfers execute ensures your assets reach your safe wallet smoothly.

9.1 Fee Breakdown by Asset

• Tokens (ERC-20) and native gas assets incur a 15% protocol recovery fee. The recovering user receives 85% net assets delivered to their safe destination wallet.
• NFTs (ERC-721 and ERC-1155) have a 0% protocol fee. Rescued NFTs are delivered 100% intact to your safe destination wallet with no fee deduction.
• Fees are collected in kind directly in the recovered asset with no external price feeds or oracles. For example, recovering 1,000 USDC delivers 850 USDC to your safe wallet and 150 USDC to the protocol.
• Gas fees are separate from protocol fees and are paid by your sponsor wallet in native network currency directly to blockchain validators.

9.2 Referral Split

• When a rescue is executed through a referral link, the 15% fee is split on-chain, where 6% goes to the referrer and 9% goes to the protocol treasury. The recovering user receives their full 85% net assets.
• If no referral link is used, or if anti-self-referral checks are triggered, the entire 15% fee goes to the protocol treasury.
• If the referrer payout address cannot receive funds (for example, a contract that rejects the transfer), the 6% cut redirects to the protocol treasury.
• If redirecting that 6% cut to the treasury also fails, the contract automatically adds the unpayable 6% back to the user's sweep amount, delivering 91% net recovery to the safe destination rather than leaving those tokens behind in the compromised wallet.

9.3 Transfer Order & Safe Destination Requirements

• Protocol fees are collected on-chain before the remaining balance is dispatched to your safe destination wallet. This fee-first order prevents malicious contracts from engineering revert traps on the protocol treasury to rescue assets for free.
• Always use a clean standard EOA wallet address or a verified Gnosis Safe as your safe destination. If a safe destination cannot receive transfers (such as a contract without a receive function for native currency, or an address blacklisted by centralized tokens like USDC or USDT), that transfer fails on-chain (CallFailed) while the fee remains collected.
• When a destination transfer fails, the remaining 85% stays behind in the compromised wallet where it remains vulnerable to sweeper bots. In that scenario, you will need to execute a new rescue with a clean, working safe wallet to recover the remaining funds, resulting in the 15% fee being charged once again on that remaining balance.
• To prevent this risk, the app verifies your safe destination address before execution:
• Standard EOA Wallets. Recommended. Standard private key wallets have no custom code and cannot reject incoming transfers.
• Gnosis Safe. Supported if your Safe is already deployed on the rescue network and accepts native coin. If your Safe is not deployed on the target chain, the rescue is blocked to protect your funds. You must deploy your Safe on that network first or use a standard EOA wallet instead.
• Other Contracts Blocked. Custom smart contracts, smart accounts, and unverified addresses are blocked to prevent your funds from getting trapped.
• If the entire transaction reverts on-chain, all state changes roll back completely via standard EVM execution and zero protocol fees are charged.

10. Custom RPC & Transaction Broadcasting

10.1 Custom RPC

• You can configure custom RPC endpoints for any supported network by clicking the RPC settings icon next to the network selector.
• When you set a custom RPC for a network, every feature that makes RPC calls on that network uses your custom endpoint.
• Custom RPCs are especially useful for fast receipt polling during follow-up rescues. When an NFT Mint or Claim transaction confirms, the receipt logs are checked to detect minted token IDs or unswept tokens and broadcast the follow-up sweep as fast as possible.
• Public RPCs often have higher latency when polling receipts and logs compared to private custom endpoints.
• Custom endpoints also help avoid occasional public RPC rate limits.
• Before saving, the endpoint is tested for connectivity, latency, and chain ID match to ensure it belongs to the selected network.
• Custom URLs are stored locally in your browser, and you can reset any network back to its default public RPC at any time with a single click.

10.2 Transaction Broadcasting

• On Ethereum, transactions broadcast through MEV Blocker first (falling back to Flashbots) to bypass the public mempool entirely and prevent MEV bots from sniffing or frontrunning the rescue.
• On BSC, transactions broadcast through 48 Club private relay to keep transactions completely hidden from the public mempool.
• If private relay broadcast fails on Ethereum or BSC, the rescue stops with an error instead of falling back to public RPCs, guaranteeing transactions are never leaked into the public mempool.
• If you set a custom RPC for Ethereum or BSC, this private relay broadcast is not overwritten.
• On all other chains, transactions broadcast through your custom RPC, immediately falling back to default backup RPCs if it fails or times out.
• All rescue batch signatures are cryptographically bound to a strict 3-minute on-chain deadline. If a transaction gets delayed in the mempool during network congestion (especially on public-mempool chains like Polygon or Berachain) or sniffed by MEV searchers, it automatically expires on-chain (revert SignatureExpired()) rather than hanging in mempool limbo or being replayed later under unexpected conditions.

11. Smart Contract & FAQ

11.1 Where can I review the smart contract and extension source code?

The core protocol is powered by SponsorableBatchExecutor.sol, deployed with identical bytecode across all 20 supported EVM mainnets. The source code for both the smart contract and the browser extension is public on GitHub under 0xbatman69/rescuekit. You can also inspect the verified bytecode directly on each chain's block explorer (see Section 12 for links).

11.2 Why does the contract address show no transaction history on block explorers?

This is entirely intentional. Transactions are sent directly to your compromised wallet address rather than to the contract itself. The contract code executes directly inside your account to transfer assets straight to your safe wallet, so your tokens never pass through a middleman contract. Because the contract address is never called as the destination of a transaction, block explorers show zero transaction history on it. Unlike tools that route everything through a shared contract where every rescue is publicly logged on a single page for anyone to monitor, your transaction history stays entirely on your own wallet.

11.3 If an MEV bot or frontrunner copies my signed transaction, can they steal the funds?

No, they cannot steal anything. If an attacker copies your transaction, changes the safe address to their own, and broadcasts it with higher gas, the signature immediately becomes invalid and the transaction reverts on-chain. If they broadcast the transaction without changing the safe address, they actually do you a favor by paying your gas bill while delivering your assets straight to your safe wallet. Furthermore, on Ethereum and BSC, rescues broadcast through private relays and never touch public mempools, so bots cannot even see them. On public mempools like Polygon or Berachain, the only thing a sweeper could try is burning gas to bump your account nonce and make the rescue revert, but they can never hijack your signature to steal your funds.

Important: While an attacker cannot hijack or modify your signed rescue transaction, if they already hold your compromised private key and have native gas to broadcast their own independent transfer, you are in an active race against them. Speed is critical. Always initiate and execute your rescue as quickly as possible.

11.4 What admin privileges does the contract owner have?

The owner can transfer contract ownership, update the feeRecipient, adjust feeBps (strictly hard-capped on-chain at 15%), set affiliateCutBps, configure reserveAmount, and toggle an emergency pause. The pause is a global circuit breaker that temporarily halts new batch executions across the protocol, and the owner cannot freeze or censor individual user wallets, nor modify any other contract parameters or logic. Deployments share identical bytecode and are verified across all 20 supported chains, so anyone is free to review the source code directly on block explorers.

11.5 What is the owner wallet address, and what happens if it gets compromised?

The owner address across all deployments is 0x7f201f66C6eE48d5A65E9067065d8953eEFD9909. If this key were ever compromised, an attacker could pause new executions, increase reserveAmount, or redirect incoming protocol fees by updating the feeRecipient. However, user funds cannot be stolen because an attacker cannot bypass user signatures, cannot redirect rescued assets away from your safe destination, and cannot increase protocol fees beyond the 15% on-chain cap. Even if an attacker sets a higher reserve, those native assets simply remain untouched inside your own wallet rather than being transferred to the attacker.

11.6 Why doesn't the contract use EIP-712?

EIP-712 was designed specifically to format structured data for human review inside wallet extension popups (like MetaMask or Rabby). In RescueKit, signing happens directly in local client memory in milliseconds, so there is no interactive wallet prompt rendering typed data. Cryptographically, using toEthSignedMessageHash that binds chainid, address(this), mode, calls, and deadline provides the exact same replay protection and execution security, without the contract bytecode bloat and extra gas cost of on-chain EIP-712 domain and typehash verification across 20 chains.

11.7 What is reserveAmount? Can the owner misuse it?

No. The contract sweeps total = balance - reserve, leaving the reserve untouched in your compromised wallet rather than sending it to the owner or your safe destination. It exists solely for Monad, which enforces a 10 MON minimum balance on delegated accounts. On every other supported chain, the reserve is 0.

11.8 Why does Mode 3 follow-up NFT rescue have no deadline?

Mode 3 is designed for NFT follow-up rescues. When an NFT's token ID cannot be predicted before minting, a follow-up transaction broadcasts as fast as possible after the receipt confirms to sweep the minted token, without requiring any manual interaction. The safe destination digest is signed automatically in memory upfront, strictly authorizing the contract to sweep NFTs to your pre-configured safe wallet. Mode 3 carries a 0% protocol fee, cannot deduct any 15% protocol fee, and cannot transfer ERC-20 tokens or native currency. Because on-chain execution is restricted strictly to transferring NFTs to that pre-authorized safe address, an expiration deadline is not required.

12. Supported Networks

RescueKit is deployed and verified across 20 EVM mainnets. All deployments share the identical contract address 0x0000000008732229ED6Dca402A3C9EbbF31068E7.

13. What RescueKit Can & Cannot Do

13.1 What RescueKit Can Do

13.2 What RescueKit Cannot Do